agentfootprint 9.136.0 → 9.137.0

package/CAPABILITIES.md

@@ -20,6 +20,9 @@ not in this table, search `src/index.ts` for the nearest noun before writing cod
 
 | If you are about to build… | It is | Where | Since |
 |---|---|---|---|
+| observing selected middleware, permission and credential facts at runtime with bounded content-minimized metadata, explicit loss counters and optional source positions; never inferring approval, redaction or complete coverage from silence | `trustBoundaryRecorder` + `TrustBoundaryRecorder` | `src/lib/trust-boundaries/` | 9.137.0 |
+| keeping a queued event's emission time and supplied engine log coordinates, without guessing a root index or confusing agent and engine run identities; absent when the engine supplies no usable position | `EventSourcePosition` + `projectEventSourcePosition` | `src/bridge/eventSourcePosition.ts` | 9.137.0 |
+| identifying which same-name tool call a permission check or credential event describes — captured at dispatch, including resume and inner pull failures; qualify with run identity, missing fields stay unknown | `ToolCallEventIdentity` + `bindToolSecurityEvents` | `src/core/agent/toolSecurityEvents.ts` | 9.137.0 |
 | guiding an evidence repair to ask for missing context without inventing values | `recoveryInstruction` + `EvidenceRecoveryContext` | `src/core/agent/evidence/` | 9.96.0 |
 | checking a typed final answer against scoped evidence before streaming or memory delivery — optional host-authored checks with enforce/observe modes, canonical JSON and bounded read-only artifacts | `answerValidation` + `AnswerValidationError` | `src/answer-validation/` | 9.95.0 |
 | turning a written operational procedure (a runbook, a triage playbook) into ONE agent tool whose every answer is EVIDENCE — coverage folded up from the inner tools it calls, rule name+version, verdict rows with GENERATED meanings, and the recorded walk as an artifact ticket, never bytes | `runbookAsTool` — dials: `procedure` (factory, invoked per call with `ctx.tools`) + `resultKind` (`'verdict/*'` arms the rowset projection; anything else ships spine + the chart's `report`) + `rules {name, version}` (default absent ⇒ `rule_version: 'undeclared'`) + `verdicts {decider, maxRows}` (default 50; `verdict_meanings` = statically declared branches + this run's rule labels + the DEFAULT branch's label, which reaches evidence only when the chart calls `decide(s, rules, {branch, label})` — fp ≥9.16.1, the default is chosen by NO rule so nothing else can name it, and inside a generated fan-out branch the static walk is blind too; an undeclared or blank label stays ABSENT from the map, never invented from a branch id, and there is deliberately NO caller-supplied meanings map) + `presentation` (`'prose'` default = ship `table` + `VERDICT_RENDER_NOTE` "output it VERBATIM"; `'panel'` = the HOST renders the rowset, so NO `table` key at all + `PANEL_RENDER_NOTE` "the rows are already on the reader's screen — do not reproduce them"; the rowset half is byte-identical across modes, `table` stays RESERVED in both, an unknown value THROWS at definition) + `walk {cap, recording}` (cap default 500; over-cap ⇒ control-flow projection, declared · `recording: true` or `{label, maxBytes}`, default OFF — ALSO files the inner chart's own `{snapshot, events, structure}` under `recording/run` and puts its ref on the spine as `walk.recording_ref`, because the ROW projection cannot be drawn; snapshot read from the REDACTED mirror so one `redact` means the same for both; over `maxBytes` (`DEFAULT_RECORDING_MAX_BYTES` = 5,000,000) it is REFUSED not truncated; every absence — no store / over size / unserializable / store threw — is STATED in `walk.recording_note`, and the four `recording_*` fields are absent entirely when the dial is off) + `composedOf` (drift-checked at agent BUILD) + kept `recorders`/`keepRecord`/`keepRecordLimit`/`redact`; reserved state keys `verdicts`/`coverage`/`report` (the `report` bag lands BESIDE the spine, never over it — a report field spelling `af_coverage`/`af_provenance`/`rule_version`/`walk`/`report_note` or a live projection key is discarded and NAMED in `result.report_note`; precedence is explicit in `report.ts`, never spread order); inner `absent()` passes through VERBATIM unless the call said `allowAbsent`; walk kind `recording/chart-walk` + `walk_segment` discriminant | `src/core/runbook/` | 9.76.0, recording 9.79.0 |

package/dist/bridge/eventMeta.js

@@ -19,7 +19,8 @@ const trace_1 = require("footprintjs/trace");
  * gracefully to 'unknown#0'.
  */
 function buildEventMeta(origin, run) {
-    const now = Date.now();
+    const stageOrigin = origin;
+    const now = stageOrigin?.timestamp ?? Date.now();
     const runtimeStageId = origin?.runtimeStageId ?? 'unknown#0';
     // Normalize subflowPath across the 3 shapes footprintjs uses:
     //   - undefined (RecorderContext: derive from runtimeStageId)
@@ -34,6 +35,9 @@ function buildEventMeta(origin, run) {
     return {
         wallClockMs: now,
         runOffsetMs: now - run.runStartMs,
+        ...(stageOrigin?.sourcePosition !== undefined && {
+            sourcePosition: stageOrigin.sourcePosition,
+        }),
         runtimeStageId,
         subflowPath,
         compositionPath: run.compositionPath,

package/dist/bridge/eventMeta.js.map

@@ -1 +1 @@
-{"version":3,"file":"eventMeta.js","sourceRoot":"","sources":["../../src/bridge/eventMeta.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAGH,6CAAwD;AAkDxD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,MAAkD,EAClD,GAAe;IAEf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,WAAW,CAAC;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,mDAAmD;IACnD,kDAAkD;IAClD,MAAM,GAAG,GAAI,MAAkC,EAAE,WAAW,CAAC;IAC7D,MAAM,WAAW,GAAsB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ;YACzB,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,gBAAgB,CAAC,IAAA,2BAAmB,EAAC,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,GAAG;QAChB,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,UAAU;QACjC,cAAc;QACd,WAAW;QACX,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5E,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,0EAA0E;QAC1E,oEAAoE;QACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AApCD,wCAoCC;AAED;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,iBAAiB,CAC/B,IAAiE,EACjE,GAA4C;IAE5C,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,6BAAqB;QAAE,OAAO,QAAQ,KAAK,GAAG,CAAC,KAAK,CAAC;IAChG,MAAM,WAAW,GAAG,IAAI,EAAE,SAAS,CAAC;IACpC,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,GAAG,CAAC,SAAS,CAAC;AACpE,CAAC;AARD,8CAQC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAuB;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAHD,4CAGC"}
+{"version":3,"file":"eventMeta.js","sourceRoot":"","sources":["../../src/bridge/eventMeta.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAGH,6CAAwD;AAsDxD;;;;;;;GAOG;AACH,SAAgB,cAAc,CAC5B,MAAkD,EAClD,GAAe;IAEf,MAAM,WAAW,GAA4B,MAAM,CAAC;IACpD,MAAM,GAAG,GAAG,WAAW,EAAE,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,WAAW,CAAC;IAC7D,8DAA8D;IAC9D,8DAA8D;IAC9D,mDAAmD;IACnD,kDAAkD;IAClD,MAAM,GAAG,GAAI,MAAkC,EAAE,WAAW,CAAC;IAC7D,MAAM,WAAW,GAAsB,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACvD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ;YACzB,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC;YACvB,CAAC,CAAC,gBAAgB,CAAC,IAAA,2BAAmB,EAAC,cAAc,CAAC,CAAC,WAAW,CAAC,CAAC;IACtE,OAAO;QACL,WAAW,EAAE,GAAG;QAChB,WAAW,EAAE,GAAG,GAAG,GAAG,CAAC,UAAU;QACjC,GAAG,CAAC,WAAW,EAAE,cAAc,KAAK,SAAS,IAAI;YAC/C,cAAc,EAAE,WAAW,CAAC,cAAc;SAC3C,CAAC;QACF,cAAc;QACd,WAAW;QACX,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC1D,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;QAC5E,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,0EAA0E;QAC1E,oEAAoE;QACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,0EAA0E;QAC1E,0EAA0E;QAC1E,oEAAoE;QACpE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;KACxD,CAAC;AACJ,CAAC;AAxCD,wCAwCC;AAED;;;;GAIG;AACU,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,iBAAiB,CAC/B,IAAiE,EACjE,GAA4C;IAE5C,MAAM,QAAQ,GAAG,IAAI,EAAE,KAAK,CAAC;IAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,6BAAqB;QAAE,OAAO,QAAQ,KAAK,GAAG,CAAC,KAAK,CAAC;IAChG,MAAM,WAAW,GAAG,IAAI,EAAE,SAAS,CAAC;IACpC,OAAO,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,GAAG,CAAC,SAAS,CAAC;AACpE,CAAC;AARD,8CAQC;AAED;;;;;;;GAOG;AACH,SAAgB,gBAAgB,CAAC,GAAuB;IACtD,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAHD,4CAGC"}

package/dist/bridge/eventSourcePosition.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectEventSourcePosition = void 0;
+/** Read only an own data property; metadata accessors are not evidence. */
+function ownData(value, key) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor && 'value' in descriptor ? descriptor.value : undefined;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+function isId(value) {
+    return typeof value === 'string' && value.length > 0;
+}
+/**
+ * Project the optional engine carrier into our public event wire vocabulary.
+ * Older or unaddressable emitters supply no coordinates. Invalid metadata is
+ * likewise unplaced, never repaired using the current executor or stage name.
+ * Only the named data fields cross this boundary, detached from their source.
+ *
+ * @internal
+ */
+function projectEventSourcePosition(event) {
+    try {
+        const position = ownData(event, 'sourcePosition');
+        if (!isRecord(position))
+            return undefined;
+        const engineRunId = ownData(position, 'runId');
+        const logRunId = ownData(position, 'logRunId');
+        const path = ownData(position, 'drillPath');
+        const committedThroughIdx = ownData(position, 'committedThroughIdx');
+        if (!isId(engineRunId) ||
+            !isId(logRunId) ||
+            !Array.isArray(path) ||
+            typeof committedThroughIdx !== 'number' ||
+            !Number.isSafeInteger(committedThroughIdx) ||
+            committedThroughIdx < -1) {
+            return undefined;
+        }
+        const length = ownData(path, 'length');
+        if (typeof length !== 'number' || !Number.isSafeInteger(length) || length < 0)
+            return undefined;
+        const drillPath = [];
+        for (let i = 0; i < length; i++) {
+            const mountId = ownData(path, String(i));
+            if (!isId(mountId))
+                return undefined;
+            drillPath.push(mountId);
+        }
+        return Object.freeze({
+            engineRunId,
+            logRunId,
+            drillPath: Object.freeze(drillPath),
+            committedThroughIdx,
+        });
+    }
+    catch {
+        // A hostile/revoked metadata proxy cannot turn an observation into a run failure.
+        return undefined;
+    }
+}
+exports.projectEventSourcePosition = projectEventSourcePosition;
+//# sourceMappingURL=eventSourcePosition.js.map

package/dist/bridge/eventSourcePosition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eventSourcePosition.js","sourceRoot":"","sources":["../../src/bridge/eventSourcePosition.ts"],"names":[],"mappings":";;;AAEA,2EAA2E;AAC3E,SAAS,OAAO,CAAC,KAAa,EAAE,GAAgB;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/D,OAAO,UAAU,IAAI,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,0BAA0B,CAAC,KAAa;IACtD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,OAAO,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QACrE,IACE,CAAC,IAAI,CAAC,WAAW,CAAC;YAClB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACf,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,OAAO,mBAAmB,KAAK,QAAQ;YACvC,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,CAAC;YAC1C,mBAAmB,GAAG,CAAC,CAAC,EACxB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAChG,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,WAAW;YACX,QAAQ;YACR,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACnC,mBAAmB;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,kFAAkF;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AApCD,gEAoCC"}

package/dist/core/Agent.js

@@ -160,6 +160,7 @@ const RunnerBase_js_1 = require("./RunnerBase.js");
 const validators_js_1 = require("./agent/validators.js");
 const route_js_1 = require("./agent/stages/route.js");
 const answerValidation_js_1 = require("./agent/stages/answerValidation.js");
+const messagePhase_js_1 = require("./agent/middleware/messagePhase.js");
 const answerCoverage_js_1 = require("./agent/stages/answerCoverage.js");
 const index_js_1 = require("../answer-validation/index.js");
 const seed_js_1 = require("./agent/stages/seed.js");
@@ -609,6 +610,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      *  kept here rather than read back from the recording. Undefined after a run
      *  that failed or paused. */
     lastRunAnswer;
+    /** Whether any run on this instance got past input admission — so a
+     *  refused FIRST turn is reported as 'never-run', never as "continue from
+     *  your earlier accepted checkpoint" when there is none. */
+    hadAdmittedRun = false;
     /** The id the CONSUMER chose, or undefined when they took the default.
      *  `this.id` cannot answer that question — it is `'agent'` either way — and
      *  the stored-conversation fingerprint refuses only on ids somebody picked
@@ -1709,6 +1714,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             this.fileIntegrityDisposition();
             // Always released: a recording left subscribed would keep listening
             // through the next run and grow a tail nobody reads.
+            this.noteAdmittedRun();
             recording?.stop();
             stopTracking();
             this.inFlightRunId = undefined;
@@ -1759,12 +1765,12 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         // Refuse BEFORE the timing guards, so "there is nothing to follow up on"
         // is never reported as "a run is in flight" for an agent that has simply
         // not run yet.
-        if (this.getLastSnapshot() === undefined) {
+        if (this.getLastSnapshot() === undefined || (this.lastInputRefused() && !this.hadAdmittedRun)) {
             throw new conversation_js_1.NoConversationError('Agent.followUp', 'never-run');
         }
         const conversation = this.checkpoint();
         if (conversation === undefined || conversation.history.length === 0) {
-            throw new conversation_js_1.NoConversationError('Agent.followUp', 'last-run-unfinished');
+            throw new conversation_js_1.NoConversationError('Agent.followUp', this.lastInputRefused() ? 'last-input-refused' : 'last-run-unfinished');
         }
         return this.run({ message, continueFrom: conversation }, options);
     }
@@ -2179,6 +2185,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             // Same terms as the fresh-run path: rows on every exit, before the
             // recording stops (9.60.0).
             this.fileIntegrityDisposition();
+            this.noteAdmittedRun();
             recording?.stop();
             this.inFlightRunId = undefined;
         }
@@ -2223,7 +2230,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      * hand it back next turn, and the agent continues where it left off — across
      * a restart, a deploy, or a different machine.
      *
-     * Returns `undefined` before any run has completed.
+     * Returns `undefined` before any run has completed or when the latest run
+     * was refused by input middleware. A refused input is not an admitted
+     * conversation. Keep an earlier accepted checkpoint to continue explicitly;
+     * `followUp()` after input denial raises `NoConversationError`.
      *
      * **Read from the run's own recording, not from a second copy.** The history
      * comes from `getLastSnapshot().sharedState.history` — the state the run
@@ -2253,8 +2263,9 @@ class Agent extends RunnerBase_js_1.RunnerBase {
      * const conversation = agent.checkpoint();          // persist anywhere
      * // …a restart later, on a fresh Agent:
      * await agent.run({ message: 'Make it three.', continueFrom: conversation });
-     * // `continueFrom` runs the 'input' middleware chain on the new turn; a user
-     * // entry appended to `history` by hand and passed to `resumeOnError` skips it.
+     * // `continueFrom` admits the new turn through the 'input' middleware chain.
+     * // `resumeOnError` rechecks originalInput but replays stored history as-is;
+     * // it does not rewrite entries manually appended to that history.
      * ```
      */
     checkpoint() {
@@ -2262,6 +2273,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         if (!snapshot)
             return undefined;
         const state = snapshot.sharedState;
+        // Admission is decided by seed, before any conversation state is written.
+        // Do not manufacture a blank replay carrier for an unadmitted attempt.
+        if (this.lastInputRefused())
+            return undefined;
         const recorded = (state?.history ?? []);
         const history = structuredClone(recorded);
         if (this.lastRunAnswer !== undefined && this.lastRunAnswer.length > 0) {
@@ -2300,6 +2315,17 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             ...(turnNumber !== undefined && { turnNumber }),
         };
     }
+    /** Called as each run/resume ends: remember a run that got past input admission. */
+    noteAdmittedRun() {
+        if (this.getLastSnapshot() !== undefined && !this.lastInputRefused()) {
+            this.hadAdmittedRun = true;
+        }
+    }
+    /** Whether input middleware refused the last run's message — the one reading both doors ask. */
+    lastInputRefused() {
+        const state = this.getLastSnapshot()?.sharedState;
+        return state?.messageDeniedPhase === 'input';
+    }
     /** Both checkpoint doors keep the repair budget separately from conversation text. */
     evidenceRecoveryOf(state) {
         if (state?.evidenceRevisionSpent !== true)
@@ -3641,7 +3667,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             }
         }
         // Message-boundary refusal (7.18+) — a `messageMiddleware` returned
-        // `deny`. The stage wrote the flags and (at 'input') broke the chart. We
+        // `deny`. The stage wrote the flags and stopped delivery. We
         // surface the typed error here, the same way a policy halt is surfaced,
         // because a refusal must never be mistaken for an answer: at 'input' no
         // model was ever asked, and at 'output' the middleware has just declined
@@ -3649,6 +3675,21 @@ class Agent extends RunnerBase_js_1.RunnerBase {
         if (this.messageMiddleware.length > 0) {
             const state = executor.getSnapshot().sharedState;
             if (state.messageDeniedReason !== undefined) {
+                if (state.messageDeniedPhase === 'output') {
+                    // The chart stopped cleanly, so ErrorBridge's onRunFailed cannot
+                    // close public streams. This API boundary owns the refusal on both
+                    // run and resume. Name it as a virtual stage, not a fabricated
+                    // engine failure, and never echo policy text into a public stream.
+                    this.dispatcher.dispatch({
+                        type: 'agentfootprint.error.fatal',
+                        payload: {
+                            error: 'The output policy withheld this answer.',
+                            stage: '__output_admission__',
+                            scope: 'run',
+                        },
+                        meta: (0, eventMeta_js_1.buildEventMeta)({ runtimeStageId: '__output_admission__' }, this.currentRunContext),
+                    });
+                }
                 throw new errors_js_3.MessageDeniedError({
                     reason: state.messageDeniedReason,
                     phase: state.messageDeniedPhase ?? 'output',
@@ -3729,6 +3770,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
     }
     // ─── Chart assembly ────────────────────────────────────────────
     buildChart() {
+        const governsOutput = (0, messagePhase_js_1.hasOutputMiddleware)(this.messageMiddleware);
         const provider = this.provider;
         const model = this.model;
         const temperature = this.temperature;
@@ -4358,7 +4400,10 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             // seam peels `_findings` where the served schema carries it (ruled
             // tools only) — value-conditional, the same grammar.
             ...(argumentSources && { argumentSources: true }),
-            ...(this.answerValidationConfig !== undefined && { suppressDraftTokens: true }),
+            ...((this.answerValidationConfig !== undefined || governsOutput) && {
+                suppressDraftTokens: true,
+            }),
+            ...(governsOutput && { withholdDraftContent: true }),
             // Tool choice by classifier (9.105.0): the outcome row after the reply.
             ...(this.toolChoiceOptions !== undefined && { toolChoice: true }),
             // The declared ontology (9.106.0): the piece served from the run
@@ -4909,6 +4954,7 @@ class Agent extends RunnerBase_js_1.RunnerBase {
             ...(this.timeOptions !== undefined && { timeWindows: true }),
             ...(inputsArmed && this.timeOptions !== undefined && { timeLimits: true }),
             ...(this.answerValidationConfig !== undefined && { hasAnswerValidation: true }),
+            ...(governsOutput && { releaseOutputTokens: true }),
             // The out-of-budget wrap-up branch (9.56.0) — the conditional-mount law
             // above, decided once beside the Route decider that routes to it so the
             // two can never disagree about whether the branch exists.